CVE-2016-7118

MEDIUM

Debian Linux - NULL Pointer Dereference

Title source: rule

Description

fs/fcntl.c in the "aufs 3.2.x+setfl-debian" patch in the linux-image package 3.2.0-4 (kernel 3.2.81-1) in Debian wheezy mishandles F_SETFL fcntl calls on directories, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via standard filesystem operations, as demonstrated by scp from an AUFS filesystem.

References (3)

Scores

CVSS v3 5.5
EPSS 0.0005
EPSS Percentile 15.9%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE
CWE-476
Status published

Affected Products (2)

debian/debian_linux
n/a/n/a

Timeline

Published Aug 31, 2016
Tracked Since Feb 18, 2026